Ensure double arrays are filled with holes when extended from variations of empty arrays.

src/elements.cc

Index: src/elements.cc
diff --git a/src/elements.cc b/src/elements.cc
index eb021e502185acb8eb7ce0af2cdc2f41fcf589ca..6103da4bb9b72f3e739ee4d378b3e25e866b6696 100644
--- a/src/elements.cc
+++ b/src/elements.cc
@@ -375,6 +375,9 @@ static void CopyPackedSmiToDoubleElements(FixedArray* from,
     copy_size = from->length() - from_start;
     if (raw_copy_size == ElementsAccessor::kCopyToEndAndInitializeToHole) {
       to_end = to->length();
+      for (uint32_t i = to_start + copy_size; i < to_end; ++i) {
+        to->set_the_hole(i);
+      }
     } else {
       to_end = to_start + static_cast<uint32_t>(copy_size);
     }
@@ -392,10 +395,6 @@ static void CopyPackedSmiToDoubleElements(FixedArray* from,
     ASSERT(!smi->IsTheHole());
     to->set(to_start, Smi::cast(smi)->value());
   }
-
-  while (to_start < to_end) {
-    to->set_the_hole(to_start++);
-  }
 }